TORONTO — The black market for software vulnerabilities is booming, with bugs regularly being sold for thousands of dollars a piece online. And one of the only ways to reduce this steady stream of hacks, according to Geekonomics author and IT security pro David Rice, is for software companies to simply write better code.
Speaking at this week’s IT 360 show in Toronto, Rice took conference attendees into the underground vulnerabilities market, where hackers – or anybody else with deep pockets for that matter – can buy access to the latest unpatched security threats.
“The irony of this cyber space world is that attackers don’t break in to anything,” Rice, who also serves as the director for California-based security consultancy The Monterey Group, said. “There are an unknown number of broken windows in every piece of software out there today. They just find holes that the vendors failed to detect themselves.”
The fact that all software comes shipped with security threats just waiting to be discovered, he said, has facilitated a vast open market among hackers looking to discover the next “zero-day” threat – a buzz word that describes a not-yet-patched vulnerability that the public does not know about.
“Reported bugs may go unfixed by manufacturers for months or years, but unreported vulnerabilities go unfixed period,” Rice said. “They give hackers carte blanc access to critical networks and systems and hackers can make a lot of money by not reporting these bugs.”
“And when you look at the patching process at some software companies, it really is dysfunctional, because you are never going to win the patch race against these guys,” he said.
To fight against zero-day threats, some security experts recommend defensive measures such as network behavior analysis and ‘white listing’ to keep all but approved applications and services from running on a network.
“You’ve got to start thinking of what to do with zero-day threats outside of patching,” Gerhard Eschelbeck, chief technology officer at Boulder, Colo.-based Webroot Software Inc., said. “There has to be more thinking in the industry about heuristic and behavioral models.”
Amrit Williams, an analyst at Stamford, Conn.-based Gartner Inc., said “there is a whole class of basically unknown exploits taking advantage of unknown vulnerabilities” that require a response beyond patching, Williams said.
In many cases, such attacks are going to be hard to stop because they hit flaws no one but the attacker knows about. So companies need to implement measures for quickly identifying such attacks and limiting fallout – including taking steps such as network segmentation, traffic filtering and using access controls, he said.
But despite the talking points from many security experts, Rice said that protecting against all risks might be impossible. In fact, not even the security measures themselves are safe from attacks.
“We always recommend users to have a firewall, because it puts a barrier in between a weakness and the rest of the world,” he said. “But your firewall is made of software and even that can have vulnerability on it.
Rice claimed that while the total number of attacks and vulnerabilities is actually on the decline, the most critical, zero-day bugs are rising dramatically. He said the fact that software manufacturing processes has largely stayed the same in recent years might be contributing to the problem.
“Plus, hackers are developing extremely good software development practices for their malware,” he added.
Rice also said that while the adoption of software engineering best practice guidelines, such as Capability Maturity Model Integration (CMMI), is helpful, most companies don’t have much incentive to continue to the highest levels of the program.
“Getting to a CMMI Level 5 can be very tedious and expensive,” Rice said. “Until it becomes more expensive to not be at Level 5, there will be no incentive to get to that level.”
And one look at the prices these vulnerabilities are going for on the black market, he said, is a testament to the size of these online criminal syndicates and the challenges they pose to software developers.
“A recent Internet Explorer exploit was priced at $100,000, while some bugs have even reached upwards of $250,000. Some of these cyber lords even have better research facilities than Symantec and McAfee right now.”
Working to combat the bug trade are companies like Sterling, Va.-based iDefense Labs and Austin, Tx.-based TippingPoint Technologies Inc., which often purchase vulnerabilities off the black market in order to help companies against potential attacks.
Some companies even offer rewards for “white hat” hackers who discover and report bugs in their software. Rice cited Mozilla’s recent program which offered a $500 bounty and a t-shirt to anyone who successfully spotted a bug in the FireFox Web browser. Dishing out even larger rewards, he said, may also be an effective way to alleviate the black market – but it will take much bigger bounties to encourage widespread, ethical reporting.
“The rewards being offered won’t stray too many hackers away from the hundreds of thousands a month they can make on the black market,” he said.
Another point to be aware of, according to Rice, is that most attackers will target lower level employees instead of risking detecting by going after the top level executives.
“E-mails that go after the personal assistants of the board members are likely to be more effective,” Rice said. “Executives and assistants often share their passwords and have the same level of access, so e-mails that target these employees are more effective.”
With files from Jaikumar Vijayan, Computerworld (US online)
